An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows malicious users to force the download of arbitrary files.
imoulife imou go 1.0.11